asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

arch linux systemd-boot+secure boot signing

Browse source
This commit is contained in:
Sergei Poljanski 2026-03-19 17:57:28 +02:00
commit faf0174638
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
1 changed files with 18 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

31
modules/boot.nix
View file

@ -15,18 +15,23 @@
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
/* GRUB disabled for Secure Boot (Lanzaboote) # Arch Linux systemd-boot entry
boot.loader.grub = { # Copies kernel/initramfs from Arch btrfs partition to ESP and creates loader entry
enable = true; system.activationScripts.archBoot = let
device = "nodev"; archEntry = pkgs.writeText "arch.conf" ''
efiSupport = true; title Arch Linux
extraEntries = '' linux /arch/vmlinuz-linux
menuentry "Arch Linux (default)" { initrd /arch/initramfs-linux.img
search --set=root --fs-uuid 15ae8384-3dfc-4915-9201-66ecfc5f230d options root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
linux /@/boot/vmlinuz-linux root=UUID=15ae8384-3dfc-4915-9201-66ecfc5f230d rootflags=subvol=@ rw
initrd /@/boot/initramfs-linux.img
}
''; '';
}; in ''
*/ mkdir -p /boot/arch
if mountpoint -q /mnt/arch; then
cp /mnt/arch/boot/vmlinuz-linux /boot/arch/vmlinuz-linux
cp /mnt/arch/boot/initramfs-linux.img /boot/arch/initramfs-linux.img
${pkgs.sbctl}/bin/sbctl sign /boot/arch/vmlinuz-linux
fi
mkdir -p /boot/loader/entries
cp ${archEntry} /boot/loader/entries/arch.conf
'';
} }